From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org, llvm@lists.linux.dev
Subject: [PATCH AUTOSEL 5.14 23/32] flow: fix object-size-mismatch warning in flowi{4,6}_to_flowi_common()
Date: Sat, 11 Sep 2021 09:11:40 -0400 [thread overview]
Message-ID: <20210911131149.284397-23-sashal@kernel.org> (raw)
In-Reply-To: <20210911131149.284397-1-sashal@kernel.org>
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
[ Upstream commit b9edbfe1adecfc48fd11061dce68afb03d6adbdc ]
Commit 3df98d79215ace13 ("lsm,selinux: pass flowi_common instead of flowi
to the LSM hooks") introduced flowi{4,6}_to_flowi_common() functions which
cause UBSAN warning when building with LLVM 11.0.1 on Ubuntu 21.04.
================================================================================
UBSAN: object-size-mismatch in ./include/net/flow.h:197:33
member access within address ffffc9000109fbd8 with insufficient space
for an object of type 'struct flowi'
CPU: 2 PID: 7410 Comm: systemd-resolve Not tainted 5.14.0 #51
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
Call Trace:
dump_stack_lvl+0x103/0x171
ubsan_type_mismatch_common+0x1de/0x390
__ubsan_handle_type_mismatch_v1+0x41/0x50
udp_sendmsg+0xda2/0x1300
? ip_skb_dst_mtu+0x1f0/0x1f0
? sock_rps_record_flow+0xe/0x200
? inet_send_prepare+0x2d/0x90
sock_sendmsg+0x49/0x80
____sys_sendmsg+0x269/0x370
__sys_sendmsg+0x15e/0x1d0
? syscall_enter_from_user_mode+0xf0/0x1b0
do_syscall_64+0x3d/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f7081a50497
Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
RSP: 002b:00007ffc153870f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f7081a50497
RDX: 0000000000000000 RSI: 00007ffc15387140 RDI: 000000000000000c
RBP: 00007ffc15387140 R08: 0000563f29a5e4fc R09: 000000000000cd28
R10: 0000563f29a68a30 R11: 0000000000000246 R12: 000000000000000c
R13: 0000000000000001 R14: 0000563f29a68a30 R15: 0000563f29a5e50c
================================================================================
I don't think we need to call flowi{4,6}_to_flowi() from these functions
because the first member of "struct flowi4" and "struct flowi6" is
struct flowi_common __fl_common;
while the first member of "struct flowi" is
union {
struct flowi_common __fl_common;
struct flowi4 ip4;
struct flowi6 ip6;
struct flowidn dn;
} u;
which should point to the same address without access to "struct flowi".
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/flow.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/net/flow.h b/include/net/flow.h
index 6f5e70240071..58beb16a49b8 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -194,7 +194,7 @@ static inline struct flowi *flowi4_to_flowi(struct flowi4 *fl4)
static inline struct flowi_common *flowi4_to_flowi_common(struct flowi4 *fl4)
{
- return &(flowi4_to_flowi(fl4)->u.__fl_common);
+ return &(fl4->__fl_common);
}
static inline struct flowi *flowi6_to_flowi(struct flowi6 *fl6)
@@ -204,7 +204,7 @@ static inline struct flowi *flowi6_to_flowi(struct flowi6 *fl6)
static inline struct flowi_common *flowi6_to_flowi_common(struct flowi6 *fl6)
{
- return &(flowi6_to_flowi(fl6)->u.__fl_common);
+ return &(fl6->__fl_common);
}
static inline struct flowi *flowidn_to_flowi(struct flowidn *fldn)
--
2.30.2
next prev parent reply other threads:[~2021-09-11 13:12 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-11 13:11 [PATCH AUTOSEL 5.14 01/32] dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 02/32] remoteproc: qcom: wcnss: Fix race with iris probe Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 03/32] mfd: db8500-prcmu: Adjust map to reality Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 04/32] PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 05/32] fuse: fix use after free in fuse_read_interrupt() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 06/32] PCI: tegra194: Fix handling BME_CHGED event Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 07/32] PCI: tegra194: Fix MSI-X programming Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 08/32] PCI: tegra: Fix OF node reference leak Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 09/32] mfd: Don't use irq_create_mapping() to resolve a mapping Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 10/32] PCI: rcar: Fix runtime PM imbalance in rcar_pcie_ep_probe() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 11/32] riscv: fix the global name pfn_base confliction error Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 12/32] PCI: rcar: Add L1 link state fix into data abort hook Sasha Levin
2021-09-11 16:05 ` Marek Vasut
2021-09-20 12:12 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 13/32] KVM: arm64: Make hyp_panic() more robust when protected mode is enabled Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 14/32] tracing/probes: Reject events which have the same name of existing one Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 15/32] PCI: cadence: Use bitfield for *quirk_retrain_flag* instead of bool Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 16/32] PCI: cadence: Add quirk flag to set minimum delay in LTSSM Detect.Quiet state Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 17/32] PCI: j721e: Add PCIe support for J7200 Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 18/32] PCI: j721e: Add PCIe support for AM64 Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 19/32] PCI: Add ACS quirks for Cavium multi-function devices Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 20/32] watchdog: Start watchdog in watchdog_set_last_hw_keepalive only if appropriate Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 21/32] octeontx2-af: Add additional register check to rvu_poll_reg() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 22/32] Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 Sasha Levin
2021-09-11 13:11 ` Sasha Levin [this message]
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 24/32] net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 25/32] block, bfq: honor already-setup queue merges Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 26/32] PCI: ibmphp: Fix double unmap of io_mem Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 27/32] loop: reduce the loop_ctl_mutex scope Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 28/32] ethtool: Fix an error code in cxgb2.c Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 29/32] NTB: Fix an error code in ntb_msit_probe() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 30/32] NTB: perf: Fix an error code in perf_setup_inbuf() Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 31/32] stmmac: dwmac-loongson:Fix missing return value Sasha Levin
2021-09-11 13:11 ` Sasha Levin
2021-09-11 13:11 ` [PATCH AUTOSEL 5.14 32/32] net: phylink: add suspend/resume support Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210911131149.284397-23-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=netdev@vger.kernel.org \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.